Virtual Private Cloud:Address resource management

Restrict VPC CIDR block allocation from IPAM address pools

In a multi-account environment, CIDR block conflicts can cause connectivity issues if business accounts independently create VPCs and randomly allocate private CIDR blocks. To prevent this, you can use a management account to create a control policy and attach it to a folder or member. This policy restricts business accounts to allocating VPC CIDR blocks only from shared IPAM pools. IPAM ensures that the allocated CIDR blocks do not overlap, which prevents address conflicts when VPCs are interconnected.

Control policies apply to all Resource Access Management (RAM) users and RAM roles of members in a resource directory, but not to the root users of the members. The management account of a resource directory is external to the resource directory. Therefore, control policies do not apply to any identities within the management account.

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "StringNotEquals": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    },
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "ForAllValues:StringNotLikeIfExists": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    }
  ],
  "Version": "1"
}

Manage addresses using resource discovery

Resource discovery continuously finds and tracks the IP address usage of VPC and vSwitch CIDR blocks within the Effective Region. After you associate a resource discovery with an IPAM instance, the IPAM instance centrally manages the discovered CIDR blocks.

1. The applicable scope of a default resource discovery is the same as that of the IPAM instance and cannot be modified.

2. Resource discovery is updated every 5 minutes.

• When you create an IPAM instance, the system creates a default resource discovery and associates it with the IPAM instance. VPC CIDR blocks that meet the following rules are automatically imported into the corresponding address pool for unified management:

  • Only unallocated CIDR blocks that are within the provisioned CIDR block of the address pool are imported.

  • CIDR blocks are imported only into address pools for which Automatically Import Discovered Resource is enabled in the default scope.

  • If multiple discovered CIDR blocks overlap, IPAM imports only the largest CIDR block.

  • If multiple identical CIDR blocks are discovered, IPAM randomly imports one of them.

• If no IPAM instance is created, you can create a custom resource discovery to track the IP address usage of VPC and vSwitch CIDR blocks. If an IPAM instance is later created in the managed region, the custom resource discovery is automatically converted into a default resource discovery.

# Specify a region where no IPAM instance is created and a custom resource discovery can be created.
provider "alicloud" {
  region = "cn-shanghai"
}

resource "alicloud_vpc_ipam_ipam_resource_discovery" "example_ipam_resource_discovery" {
  operating_region_list               = ["cn-shanghai"]     # Specify the applicable scope of the IPAM resource discovery.
  ipam_resource_discovery_name        = "example_ipam_resource_discovery_name"
}

Use shared resource discovery for unified address management

If business accounts use unplanned CIDR blocks to create resources, address conflicts can occur. A network administrator can associate an IPAM instance with a resource discovery shared by a business account to centrally manage resources across multiple accounts and resolve address conflicts.

Both default and custom resource discoveries can be shared.

The applicable scope of a shared resource discovery and the applicable scope of the network administrator's IPAM instance can be different, but their managed regions (creation regions) must be the same. If the applicable scopes are different:

• The resource owner (business account in this example) and the network administrator can manage and view all resources within the applicable scope of the resource discovery.

• After the network administrator associates the resource discovery with an IPAM instance, the administrator can manage only the resources within the applicable scope of the IPAM instance.

Monitor address utilization

Monitor address utilization to scale out resources with high utilization in a timely manner.

• Monitor the address utilization of an address pool: Go to the IPAM console - IPAM Pool page and click the ID of the target address pool.

  • On the Details tab, you can view the number of available IP addresses in the address pool and the number of IP addresses allocated to resources and sub-pools. If the target address pool is a sub-pool, you can also view the address utilization of both the sub-pool and its source pool.

  • On the IP Address Usage and Allocation tabs, you can view the specific allocation details of the address pool.

• Monitor the address utilization of VPCs and vSwitches:

  • Go to the IPAM console - Resource Discovery page. Click the ID of the target resource discovery to view the CIDR blocks and IP address usage of all VPCs and vSwitches in the applicable scope.

  • Go to the IPAM console - IPAM Scope page and click the ID of the target scope.

    • On the Resource Management tab, you can view the CIDR blocks and address utilization of VPCs and vSwitches within this scope. Click the ID of a target VPC or vSwitch to view its IP address usage.

    • On the Monitoring Charts tab, you can monitor the address utilization of VPCs and vSwitches within this scope over time using line charts.

Monitor address overlaps

Monitor address overlaps to proactively discover and resolve address conflicts, which helps prevent access conflicts during network interconnection.

Go to the IPAM console - IPAM Scope page and click the ID of the target scope.

• On the Resource Management tab, you can view the overlap status of VPC and vSwitch CIDR blocks within this scope. If CIDR blocks overlap, you can click View in the Overlap Status column to see the specific instances that conflict with the current resource.

• On the Monitoring Charts tab, you can monitor the number of overlapping CIDR blocks within this scope over time using line charts.

Monitor the management status and compliance of CIDR blocks

Go to the IPAM console - IPAM Scope page. Click the ID of the target scope. On the Overview, Resource Management, and Monitoring Chart tabs, you can check if a CIDR block is managed (allocated from an IPAM pool) and compliant (complies with the allocation rules of the IPAM pool).

Billing

IPAM is in public preview. It is free of charge during the public preview period.

Quotas